topic set earliest from string in Dashboards & Visualizations

set earliest from string

kennethyeung — Sat, 10 Feb 2018 11:36:53 GMT

i have a dashboard, in the click.value will have a string value (e.g 20182010)
and then below have another line chart, but how can i put the token to that search

e.g
index=test earliest=$token_date$

i think the $token_date need to use strptime to convert and then pass to search. but how?
Thanks

Re: set earliest from string

kamlesh_vaghela — Sat, 10 Feb 2018 12:02:09 GMT

hi @kennethyeung,

You can use strptime when you click on chart and set token_date. what is date format of 20182010?
Can you please share you sample dashboard xml?

Re: set earliest from string

kennethyeung — Tue, 29 Sep 2020 18:02:35 GMT

Thanks your suggestion, i should eval token instead of eval in the search
strftime(strptime($click.value$,"%Y%m%d"),"%m/%d/%Y:00:00:00")
and the in search

index=$tok_index$ earliest="$tok_date$"

Re: set earliest from string

kamlesh_vaghela — Sat, 10 Feb 2018 12:48:32 GMT

So, have you resolved your issue?

Re: set earliest from string

niketn — Sun, 11 Feb 2018 08:37:50 GMT

Is it is table or chart that you are clicking to get 20182010 as click.value?

Re: set earliest from string

sashraf — Sun, 11 Feb 2018 14:59:10 GMT

Instead of having earliest=$token_date$ in your search, replace it with the following subsearch:

[| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%d%m") | fields + earliest]

So your example search would instead look like this:

index=test [| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%d%m") | fields + earliest]

This is all assuming the date format you have is YYYYDDMM which would translate to 20th October 2018 with your example of 20182010. If the date format will be YYYYMMDD then use this instead:

index=test [| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%m%d") | fields + earliest]